I85PREP
⌘ K
CISEC-IT study materials
CISEC-IT study resources

CISEC-IT: Incident Response, Business Continuity, and Crisis Management

CISEC-IT · Work through your exam, one topic at a time.

All guide sections

Incident Response, Business Continuity, and Crisis Management

Incident Response, Business Continuity, and Crisis Management

This domain tests whether you can run a structured response while the business is degraded, and whether you understand the recovery objectives that drive investment. Expect questions on lifecycle phases, severity criteria, RTO/RPO, crisis communication, and notification clocks.

Response lifecycle

NIST SP 800-61 phases: preparation; detection and analysis; containment, eradication and recovery; post-incident activity. Pre-agreed severity classification and playbooks decide who declares an incident, who leads, and when executives and legal are engaged. Evidence preservation and chain of custody must be established before remediation destroys artifacts.

Continuity fundamentals

  • A business impact analysis identifies critical processes, dependencies, and maximum tolerable downtime.
  • RTO is the target time to restore a function; RPO is the acceptable data loss measured in time; MTPD is the point of intolerable harm.
  • Business continuity covers the whole organisation; disaster recovery covers technology. Crisis management covers executive decision-making, communications, and stakeholder handling.

Worked example

Ransomware encrypts the ERP. The BIA sets RTO 72 hours and RPO 4 hours. Backup restore testing shows immutable backups exist but the newest is 12 hours old, so the achieved RPO is 12 hours - a gap requiring either more frequent snapshots or log shipping. Meanwhile the crisis team activates, legal assesses notification obligations, communications drafts holding statements, and the insurer is engaged per policy terms before any external statement. Reasoning: recovery capability is proven by testing, not by owning backup software; and legal, comms, and insurance run in parallel with technical recovery.

Traps that cost marks

  • Swapping RTO and RPO. RTO is time to restore; RPO is data loss tolerance.
  • Treating backups as a DR plan without restoration testing, alternate sites, and dependency mapping.
  • Declaring incidents without pre-defined severity criteria, producing inconsistent escalation.
  • Overlooking regulatory and contractual notification clocks during containment.
  • Skipping the post-incident review, so the same root cause recurs.